@bevel-software/platform-core-backend 0.13.5 → 0.14.0

package/src/modules/workflow/git/git.service.ts

@@ -271,6 +271,8 @@ export class GitService implements IGitService {
   // worst case for branch-switching UX).
   private readonly fetchLocks = new Map<string, Promise<void>>();
   private readonly lastImplicitFetchAt = new Map<string, number>();
+  /** Whether the last implicit fetch per workspace SUCCEEDED — see `fetchOriginIfStale`. */
+  private readonly lastImplicitFetchOk = new Map<string, boolean>();
   private static readonly IMPLICIT_FETCH_TTL_MS = 5_000;
   // Cap on concurrent `aheadBehindForBranch` calls inside `listBranches`. Each
   // call serializes up to 3 `git rev-list` spawns, so 8 workers ≈ ≤24
@@ -315,6 +317,11 @@ export class GitService implements IGitService {
    */
   noteWorkspaceFetched(workspaceId: string): void {
     this.lastImplicitFetchAt.set(workspaceId, Date.now());
+    // A fresh clone IS a successful fetch. Without this, a workspace
+    // recreated after some earlier failed fetch inherits the stale `false`
+    // under the same id, and a strict listBranches inside the TTL window
+    // refuses a list that is in fact provably fresh.
+    this.lastImplicitFetchOk.set(workspaceId, true);
   }
 
   /**
@@ -399,7 +406,7 @@ export class GitService implements IGitService {
 
   async listBranches(
     workspaceId: string,
-    opts: { freshFetch?: boolean } = {},
+    opts: { freshFetch?: boolean; strictFetch?: boolean } = {},
   ): Promise<BranchInfo[]> {
     const cwd = await this.repoDir(workspaceId);
     // Run the fetch BEFORE entering the mutex so a slow origin can't block
@@ -409,7 +416,18 @@ export class GitService implements IGitService {
     // bypasses the TTL — used for user-initiated refreshes (opening the branch
     // selector) so a draft another workspace just deleted is pruned right away
     // instead of lingering up to one TTL window.
-    await this.fetchOriginIfStale(cwd, workspaceId, opts.freshFetch);
+    const fresh = await this.fetchOriginIfStale(cwd, workspaceId, opts.freshFetch);
+    // `strictFetch` is for callers that USE the list to prove absence — the
+    // deleted-branch sweep closes change requests on it. The degrade-to-stale
+    // behaviour below is right for a UI listing (stale branches beat a 500),
+    // and exactly wrong for an absence proof: a clone that last fetched
+    // before a branch was created reports it missing. Such a caller gets a
+    // thrown error instead of a list it must not trust.
+    if (opts.strictFetch && !fresh) {
+      throw new Error(
+        'the fetch from origin failed, so the branch list cannot prove absence — refusing to serve a stale list to a strict caller',
+      );
+    }
     return this.mutex.run(workspaceId, async () => {
       // Union local heads with origin's remote-tracking refs: a fresh per-user
       // clone only has one local head (HEAD's default), so without this we'd hide
@@ -509,7 +527,10 @@ export class GitService implements IGitService {
    * onto a single in-flight fetch instead of each waiting their turn behind
    * the network round-trip. Failures (offline, bad auth, no remote) are
    * logged and swallowed so the branch list still serves stale local data
-   * instead of returning 500.
+   * instead of returning 500 — the RETURN VALUE says whether the refs are
+   * provably fresh (`true`: this call fetched, or shared a fetch, that
+   * succeeded; also `true` on a TTL skip, whose window a recent success
+   * opened). Callers that need proof (strict listing) read it.
    *
    * Safe to keep outside the mutex: fetch only writes remote-tracking refs
    * and the object store, neither of which checkout/status/commit touch.
@@ -518,9 +539,11 @@ export class GitService implements IGitService {
     cwd: string,
     workspaceId: string,
     force = false,
-  ): Promise<void> {
+  ): Promise<boolean> {
     const last = this.lastImplicitFetchAt.get(workspaceId) ?? 0;
-    if (!force && Date.now() - last < GitService.IMPLICIT_FETCH_TTL_MS) return;
+    if (!force && Date.now() - last < GitService.IMPLICIT_FETCH_TTL_MS) {
+      return this.lastImplicitFetchOk.get(workspaceId) ?? true;
+    }
 
     const inFlight = this.fetchLocks.get(workspaceId);
     if (inFlight) {
@@ -529,7 +552,7 @@ export class GitService implements IGitService {
       // the same promise also means subsequent listBranches calls see the
       // newly fetched refs.
       await inFlight;
-      return;
+      return this.lastImplicitFetchOk.get(workspaceId) ?? false;
     }
 
     const runFetch = async (): Promise<void> => {
@@ -546,6 +569,7 @@ export class GitService implements IGitService {
           ...SAFE_IMPLICIT_FETCH_ARGS,
         ]);
         this.lastImplicitFetchAt.set(workspaceId, Date.now());
+        this.lastImplicitFetchOk.set(workspaceId, true);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         console.warn(`[git] implicit fetch failed for workspace ${workspaceId}: ${msg}`);
@@ -553,12 +577,14 @@ export class GitService implements IGitService {
         // every subsequent listBranches retry the (still-failing) fetch and
         // pile up 10s timeouts. Stale local refs are better than spinning.
         this.lastImplicitFetchAt.set(workspaceId, Date.now());
+        this.lastImplicitFetchOk.set(workspaceId, false);
       }
     };
     const p = runFetch();
     this.fetchLocks.set(workspaceId, p);
     try {
       await p;
+      return this.lastImplicitFetchOk.get(workspaceId) ?? false;
     } finally {
       // Drop the lock once the fetch settles so the next caller past the TTL
       // can spawn a fresh one. Compare-and-delete in case a future race
@@ -1781,17 +1807,46 @@ export class GitService implements IGitService {
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
+      // Same per-file rule as the diff endpoints: `git log -- <dir>` lists
+      // every child's commits, and even metadata (subjects, authors, when)
+      // is history the per-file gate never authorized for the children. A
+      // HEAD check alone is not enough — a directory deleted before HEAD is
+      // absent NOW and still traversed by the log — so the proof comes from
+      // what the log itself TOUCHED: `--name-only` lists the paths behind
+      // each listed commit, and any name that is not exactly the requested
+      // path means the pathspec matched a tree somewhere in the range.
+      await this.assertNotTreeAtRef(cwd, 'HEAD', repoRelativePath, relativePath);
       const { stdout } = await this.git(cwd, [
         'log',
         `--max-count=${max}`,
-        '--pretty=format:%H%x00%an%x00%ae%x00%s%x00%aI',
+        '--name-only',
+        '--pretty=format:%x01%H%x00%an%x00%ae%x00%s%x00%aI',
         '--',
         repoRelativePath,
       ]);
+      for (const chunk of stdout.split('\u0001')) {
+        const lines = chunk.split('\n');
+        for (const nameLine of lines.slice(1)) {
+          // No trim: a tracked name CAN begin or end with whitespace, and
+          // trimming it here would reject that valid file as a directory.
+          // Only the genuinely empty separator lines are skipped.
+          const touched = nameLine.endsWith('\r') ? nameLine.slice(0, -1) : nameLine;
+          if (touched && touched !== repoRelativePath) {
+            throw new WorkflowValidationError(
+              `"${relativePath}" is a directory at that point in history — history is served per file`,
+            );
+          }
+        }
+      }
       return stdout
+        .split('\u0001')
+        .join('')
         .split('\n')
         .map((line) => line.trim())
         .filter(Boolean)
+        // `--name-only` interleaves the touched path under each commit line;
+        // only the field lines carry the NUL separators.
+        .filter((line) => line.includes('\x00'))
         .map((line): CommitAttribution => {
           const [sha, authorName, authorEmail, subject, committedAt] = line.split('\x00');
           return {
@@ -1817,6 +1872,11 @@ export class GitService implements IGitService {
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
+      // BOTH sides: at a commit that DELETES a directory the path is absent
+      // at `sha` but a tree at `sha^` — and the diff of that deletion is
+      // every child's content, exactly what the per-file gate never checked.
+      await this.assertNotTreeAtRef(cwd, sha, repoRelativePath, relativePath);
+      await this.assertNotTreeAtRef(cwd, `${sha}^`, repoRelativePath, relativePath);
       try {
         const { stdout } = await this.git(cwd, [
           'show',
@@ -1862,6 +1922,9 @@ export class GitService implements IGitService {
     }
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
+      const cwd = await this.repoDir(workspaceId);
+      await this.assertNotTreeAtRef(cwd, sha, repoRelativePath, relativePath);
+      await this.assertNotTreeAtRef(cwd, `${sha}^`, repoRelativePath, relativePath);
       const current = await this.readFileAtRef(workspaceId, sha, repoRelativePath);
       let baseline: string | null;
       try {
@@ -1898,6 +1961,8 @@ export class GitService implements IGitService {
       const cwd = await this.repoDir(workspaceId);
       const fromRef = await this.resolveBranchRef(cwd, fromBranch);
       const toRef = await this.resolveBranchRef(cwd, toBranch);
+      await this.assertNotTreeAtRef(cwd, fromRef, repoRelativePath, relativePath);
+      await this.assertNotTreeAtRef(cwd, toRef, repoRelativePath, relativePath);
       // When one side is the currently-checked-out branch, diff against the
       // working tree instead of the branch's HEAD commit. Otherwise saves
       // that haven't been committed yet (which is the normal state in the
@@ -2394,6 +2459,49 @@ export class GitService implements IGitService {
    * `showAtRef`) — the caller distinguishes "absent" from "present but empty".
    * Read-only: `git show <ref>:<path>` never mutates the working tree.
    */
+  /**
+   * Refuse a history pathspec that names a TREE at `ref`. The history
+   * surfaces are per-file, and their read gate upstream checked exactly one
+   * path — but `git show/diff -- <dir>` walks every child, and a directory
+   * whose folder chain grants read can hold children whose own frontmatter
+   * denies it. `git show <ref>:<dir>` even prints the tree listing. Absent
+   * at the ref is fine (absent is not a tree — a deleted file's history is
+   * still its own), and an unresolvable ref is left for the actual read to
+   * report in its own words.
+   */
+  private async assertNotTreeAtRef(
+    cwd: string,
+    ref: string,
+    repoRelativePath: string,
+    displayPath: string,
+  ): Promise<void> {
+    let kind: string;
+    try {
+      const { stdout } = await this.git(cwd, ['cat-file', '-t', `${ref}:${repoRelativePath}`]);
+      kind = stdout.trim();
+    } catch (err) {
+      // ONLY proven absence passes: the path missing at the ref, or the ref
+      // itself unresolvable (a root commit's `^`), which the actual read
+      // reports in its own words. Anything else — a locked repo, a corrupt
+      // object, git failing to run — must not be read as "not a tree": a
+      // guard that fails open on its own errors is not a guard.
+      const msg = err instanceof Error ? err.message : String(err);
+      if (
+        /not a valid object name|invalid object name|does not exist in|unknown revision|bad revision|exists on disk, but not in/i.test(
+          msg,
+        )
+      ) {
+        return;
+      }
+      throw err;
+    }
+    if (kind === 'tree') {
+      throw new WorkflowValidationError(
+        `"${displayPath}" is a directory at that point in history — history is served per file`,
+      );
+    }
+  }
+
   async readFileAtRef(
     workspaceId: string,
     ref: string,

package/src/modules/workflow/workflow.routes.ts

@@ -26,6 +26,8 @@ import type {
   PostChangeRequestCommentInput,
 } from '@bevel-software/platform-shared';
 import type { AuthService } from '../auth/auth.service.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import { canReadWorkspacePath, toKbRelative } from '../access-model/kb-read-filter.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import type { WorkflowEventBus } from './event-bus.js';
@@ -60,6 +62,8 @@ export function createWorkflowRoutes(
   workspaceService: WorkspaceService,
   authService: AuthService,
   events: WorkflowEventBus,
+  accessControl: IAccessControl,
+  kbDirName: string,
 ): express.Router {
   const router = express.Router({ mergeParams: true });
 
@@ -93,6 +97,62 @@ export function createWorkflowRoutes(
     }
   }
 
+  /**
+   * Gate a history read on the same `read:` verb the content routes enforce.
+   * The history endpoints below serve a file's past — its commit list, its
+   * diffs, its full content at a commit — and a file's past IS its content,
+   * with a time axis. They used to check only "is authenticated", so any
+   * logged-in user could pull a read-denied file's history by path, straight
+   * past the default-deny read model that hides the file everywhere else.
+   * Same rules as the content read (`workspace.routes` /
+   * `diff.routes.canReadPath`): the FULL `canRead` (per-node frontmatter
+   * honoured), non-KB paths ungated (they carry no `read:` rules), and both
+   * denial and any error fail closed with the content route's 403.
+   */
+  async function requireReadPermission(
+    req: express.Request,
+    res: express.Response,
+    workspaceId: string,
+    relativePath: string,
+  ): Promise<boolean> {
+    const user = await requireUser(req, res);
+    if (!user) return false;
+    // No ungated path form here, unlike the content routes: the git layer
+    // accepts BOTH the workspace-relative form (`knowledge-base/GTM/x.md`)
+    // and the repo-relative one (`GTM/x.md` — it strips the prefix when
+    // present, `stripRepoPrefix`), so treating an unprefixed path as
+    // "non-KB, no rules" would let the same repository object through
+    // without its gate. History exists only for tracked files and every
+    // tracked file lives in the repository — a path without the prefix is
+    // refused, not exempted. (Workspace scratch files outside the repo are
+    // untracked; their "history" was always an empty list.)
+    if (toKbRelative(relativePath, kbDirName) === null) {
+      res.status(400).json({
+        error: `History is served for repository files — pass the workspace-relative path (starting "${kbDirName}/").`,
+      });
+      return false;
+    }
+    let allowed: boolean;
+    try {
+      allowed = await canReadWorkspacePath(
+        (w, e, p) => accessControl.canRead(w, e, p),
+        workspaceId,
+        user.email,
+        kbDirName,
+        relativePath,
+      );
+    } catch (err) {
+      const { status, body } = toHttpError(err);
+      res.status(status).json(body);
+      return false;
+    }
+    if (!allowed) {
+      res.status(403).json({ error: `You don't have permission to read "${relativePath}".` });
+      return false;
+    }
+    return true;
+  }
+
   // ── Branches ──────────────────────────────────────────────────────────────
 
   router.get('/workspace/:id/workflow/branches', async (req, res) => {
@@ -250,12 +310,12 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/changes', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
     if (!pathParam) {
       res.status(400).json({ error: 'path is required' });
       return;
     }
+    if (!(await requireReadPermission(req, res, req.params.id, pathParam))) return;
     const rawLimit = Number.parseInt(String(req.query.limit ?? '20'), 10);
     const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.min(rawLimit, 100)) : 20;
     try {
@@ -267,7 +327,6 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/compare-file', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
     const fromBranch = typeof req.query.from === 'string' ? req.query.from : '';
     const toBranch = typeof req.query.to === 'string' ? req.query.to : '';
@@ -275,6 +334,47 @@ export function createWorkflowRoutes(
       res.status(400).json({ error: 'path, from, and to are required' });
       return;
     }
+    if (!(await requireReadPermission(req, res, req.params.id, pathParam))) return;
+    // The other history endpoints serve commits of the URL workspace's own
+    // branch, so its working-tree verdict covers what they return. This one
+    // serves content of TWO caller-named branches — the verdict must come
+    // from the refs actually being served, or a caller could pick a
+    // workspace whose tree grants what the compared branches' trees deny.
+    //
+    // The comparison prefers a LOCAL ref (and the working tree for the
+    // checked-out branch) over `origin/<branch>`, so both candidate refs are
+    // authorized: every ref that RESOLVES must grant the read, and a branch
+    // none of whose refs resolve is denied — never serve a ref that cannot
+    // be authorized. (The working-tree side is additionally covered by the
+    // workspace `canRead` above.)
+    {
+      const user = await requireUser(req, res);
+      if (!user) return;
+      const repoRelative = toKbRelative(pathParam, kbDirName)!;
+      for (const branch of [fromBranch, toBranch]) {
+        const verdicts: (boolean | null)[] = [];
+        for (const ref of [`origin/${branch}`, branch]) {
+          try {
+            verdicts.push(await accessControl.canReadAtRef(req.params.id, ref, user.email, repoRelative));
+          } catch (err) {
+            // An access-model FAILURE is not an unresolvable ref: mapped to
+            // null it would let the other candidate's grant serve a ref
+            // whose authorization errored. Fail closed — but keep the
+            // error's own status: an unreadable access tree is the
+            // documented 503 a client retries, not a permanent 403 denial.
+            const { status, body } = toHttpError(err);
+            res.status(status).json(body);
+            return;
+          }
+        }
+        const denied = verdicts.some((v) => v === false);
+        const unresolvable = verdicts.every((v) => v === null);
+        if (denied || unresolvable) {
+          res.status(403).json({ error: `You don't have permission to read "${pathParam}" on "${branch}".` });
+          return;
+        }
+      }
+    }
     try {
       const diff = await workflow.compareFile(req.params.id, pathParam, fromBranch, toBranch);
       res.json({ diff });
@@ -285,13 +385,13 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/show-file', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
     const sha = typeof req.query.sha === 'string' ? req.query.sha : '';
     if (!pathParam || !sha) {
       res.status(400).json({ error: 'path and sha are required' });
       return;
     }
+    if (!(await requireReadPermission(req, res, req.params.id, pathParam))) return;
     try {
       const diff = await workflow.showFileAtChange(req.params.id, pathParam, sha);
       res.json({ diff });
@@ -302,13 +402,13 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/file-at-change', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
     const sha = typeof req.query.sha === 'string' ? req.query.sha : '';
     if (!pathParam || !sha) {
       res.status(400).json({ error: 'path and sha are required' });
       return;
     }
+    if (!(await requireReadPermission(req, res, req.params.id, pathParam))) return;
     try {
       const { baseline, current } = await workflow.fileAtChange(req.params.id, pathParam, sha);
       res.json({ baseline, current });